Skip to content

Conversation

@openshift-ci-robot
Copy link

openshift-ci-robot commented Dec 9, 2024

@skrthomas: This pull request references OSDOCS-11625 which is a valid jira issue.

In response to this:

Version(s):

Issue:

https://issues.redhat.com/browse/OSDOCS-12600
Link to docs preview:

QE review:

  • QE has approved this change.

Additional information:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Dec 9, 2024
@openshift-ci openshift-ci bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Dec 9, 2024
@skrthomas
Copy link
Contributor Author

/retest

@ocpdocs-previewbot
Copy link

ocpdocs-previewbot commented Dec 10, 2024

@openshift-ci-robot
Copy link

openshift-ci-robot commented Dec 10, 2024

@skrthomas: This pull request references OSDOCS-11625 which is a valid jira issue.

In response to this:

Version(s):

Issue:

https://issues.redhat.com/browse/OSDOCS-12600
Link to docs preview:

https://85999--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/observing-network-traffic.html#network-observability-viewing-network-events_nw-observe-network-traffic
QE review:

  • QE has approved this change.

Additional information:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jan 17, 2025

@skrthomas: This pull request references OSDOCS-11625 which is a valid jira issue.

In response to this:

Version(s):

Issue:

https://issues.redhat.com/browse/OSDOCS-12600
Link to docs preview:

Overview: https://85999--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/observing-network-traffic.html#network-observability-networking-events-overview_nw-observe-network-traffic

Viewing network events: https://85999--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/observing-network-traffic.html#network-observability-viewing-network-events_nw-observe-network-traffic
QE review:

  • QE has approved this change.

Additional information:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

features:
- "NetworkEvents"
----
<1> The `sampling` parameter is set to a value of 1 so that all network events are captured.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sampling of 1 is more of recommendation and not a must in case users have resources concerns

[source,text]
----
Allowed by admin network policy allow-egress-iperf, direction Egress
---- No newline at end of file

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How I can view the above examples are their link to other doc there is todo ?

Copy link
Contributor Author

@skrthomas skrthomas Jan 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@msherif1234 sorry I thought I posted this comment, but I accidentally started a review instead of adding a single comment. I thought these examples are printed in the Network Events column? You shared this screencapture with me a while ago:
image

@msherif1234
Copy link

u need state this is TP feature and we need a section about network events metrics

Copy link

@memodi memodi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@skrthomas not sure which OCP version this docs are intended for, but just a note, this feature is only supported for OCP 4.17 and we should mention that cluster must be in TechPreviewNoUpgrade mode (see https://docs.openshift.com/container-platform/4.17/nodes/clusters/nodes-cluster-enabling-features.html#nodes-cluster-enabling-features-cli_nodes-cluster-enabling)

Besides that I have similar comments as @msherif1234 pointed out on showing examples.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jan 27, 2025

@skrthomas: This pull request references OSDOCS-11625 which is a valid jira issue.

In response to this:

Version(s):

4.17, 4.18
Issue:

https://issues.redhat.com/browse/OSDOCS-12600
Link to docs preview:

Overview: https://85999--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/observing-network-traffic.html#network-observability-networking-events-overview_nw-observe-network-traffic

Viewing network events: https://85999--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/observing-network-traffic.html#network-observability-viewing-network-events_nw-observe-network-traffic
QE review:

  • QE has approved this change.

Additional information:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@skrthomas
Copy link
Contributor Author

skrthomas commented Jan 27, 2025

@memodi Thanks Mehul. Unfortunately, I think since this feature is only for 4.17 and 4.18, I'm going to have to re-open this PR against main instead of no-1.8. Because everything in no-1.8 will go to 4.12+. Thanks for pointing that out.

Re: TechPreviewNoUpgrade mode, I can make it clearer that enabling that is part of the OVN-K documentation I mention in the Prerequisites. Here's a preview link to that documentation page that I'll be linking to. Username/password is redhat/redhat to view the unpublished docs: https://docs.openshift.com/container-platform/4.18/networking/ovn_kubernetes_network_provider/ovn-kubernetes-troubleshooting-sources.html#nw-ovn-kubernetes-observability_ovn-kubernetes-sources-of-troubleshooting-information

Regarding your question about the example text, what I have shown is meant to be an example of the kinds of text you can see in the Network Events column. I thought that there was a possibility for a variety of messages to print in this field, depending on the type/characteristic of the network event. Are there specific filtering parameters in the UI that will render each of the types of examples I have listed? cc @msherif1234

@skrthomas skrthomas force-pushed the OSDOCS-12600 branch 5 times, most recently from ddd80a1 to 57254a8 Compare January 29, 2025 15:57

.Prerequisites
* Must have `OVNObservability` enabled by enabling the `TechPreviewNoUpgrade` feature set in the `FeatureGate` CR named `cluster`. For more information, see "Enabling feature sets using the CLI" and "Checking OVN-Kubernetes network traffic with OVS sampling using the CLI" in the "Additional resources" of this section.
* Must have a network policy enabled to see network events for network policy, as shown in the Verification.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@memodi @msherif1234 does it help to add to the prerequisites that they must have a network policy enabled to be able to see network policy events?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor Author

@skrthomas skrthomas Jan 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed adjusted the example output in the verification to be more inclusive and flexible for different output scenarios.

I noted that this is a prerequsite in the OVN-K documentation:

You have created at least one of the following network APIs: NetworkPolicy, AdminNetworkPolicy, BaselineNetworkPolicy, UserDefinedNetwork isolation, multicast, or egress firewalls.

I know we were discussing whether or not this should be a prerequisite. Maybe it should, since it is in the OVN-K docs?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know we were discussing whether or not this should be a prerequisite. Maybe it should, since it is in the OVN-K docs?

Ok, let's follow them then. My rationale was that you can turn on the feature even without having any policy defined - and the network events still tell you meaningful information by their absence - that there is no policy installed. But let's be consistent with ovnk doc ;-)

@skrthomas
Copy link
Contributor Author

Example for Metrics covered here: https://github.com/openshift/openshift-docs/pull/87747/files

cc @jotak

@skrthomas skrthomas force-pushed the OSDOCS-12600 branch 2 times, most recently from 4cbd997 to 3827e7b Compare January 29, 2025 18:27
@skrthomas skrthomas added this to the Continuous Release milestone Jan 31, 2025
@openshift-ci openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 31, 2025
@openshift-ci openshift-ci bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 31, 2025
@skrthomas skrthomas added the peer-review-needed Signifies that the peer review team needs to review this PR label Feb 3, 2025
@xenolinux xenolinux added peer-review-in-progress Signifies that the peer review team is reviewing this PR and removed peer-review-needed Signifies that the peer review team needs to review this PR labels Feb 4, 2025
Copy link
Contributor

@xenolinux xenolinux left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple of comments to consider; otherwise LGTM

:FeatureName: Viewing `NetworkEvents`
include::snippets/technology-preview.adoc[]

You use network event tracking in Network Observability to gain insight into OVN-Kubernetes events, including network policies, admin network policies, and egress firewalls. You can use the insights from tracking network events to help with the following:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
You use network event tracking in Network Observability to gain insight into OVN-Kubernetes events, including network policies, admin network policies, and egress firewalls. You can use the insights from tracking network events to help with the following:
You use network event tracking in Network Observability to gain insight into OVN-Kubernetes events, including network policies, admin network policies, and egress firewalls. You can use the insights from tracking network events to help with the following events:

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm I am thinking maybe "tasks" instead of "events"?

:FeatureName: Viewing `NetworkEvents`
include::snippets/technology-preview.adoc[]

You can view information about network traffic events, such as network flows that are dropped or allowed by a `NetworkPolicy``, `AdminNetworkPolicy`, `BaselineNetworkPolicy`, `EgressFirewall`, `UserDefinedNetwork` isolation, or Multicast ACLs by editing the `FlowCollector` to the specifications in the following YAML example.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
You can view information about network traffic events, such as network flows that are dropped or allowed by a `NetworkPolicy``, `AdminNetworkPolicy`, `BaselineNetworkPolicy`, `EgressFirewall`, `UserDefinedNetwork` isolation, or Multicast ACLs by editing the `FlowCollector` to the specifications in the following YAML example.
You can view information about network traffic events, such as network flows that are dropped or allowed by the following resources:
* `NetworkPolicy`
* `AdminNetworkPolicy`
* `BaselineNetworkPolicy`
* `EgressFirewall`
* `UserDefinedNetwork` isolation
* Multicast ACLs by editing the `FlowCollector` to the specifications in the following YAML example.
  • Consider using a bullet list
  • Consider expanding ACL

You can view information about network traffic events, such as network flows that are dropped or allowed by a `NetworkPolicy``, `AdminNetworkPolicy`, `BaselineNetworkPolicy`, `EgressFirewall`, `UserDefinedNetwork` isolation, or Multicast ACLs by editing the `FlowCollector` to the specifications in the following YAML example.

.Prerequisites
* Must have `OVNObservability` enabled by enabling the `TechPreviewNoUpgrade` feature set in the `FeatureGate` CR named `cluster`. For more information, see "Enabling feature sets using the CLI" and "Checking OVN-Kubernetes network traffic with OVS sampling using the CLI" in the "Additional resources" of this section.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* Must have `OVNObservability` enabled by enabling the `TechPreviewNoUpgrade` feature set in the `FeatureGate` CR named `cluster`. For more information, see "Enabling feature sets using the CLI" and "Checking OVN-Kubernetes network traffic with OVS sampling using the CLI" in the "Additional resources" of this section.
* You must have `OVNObservability` enabled by setting the `TechPreviewNoUpgrade` feature in the `FeatureGate` custom resource (CR) named `cluster`. For more information, see "Enabling feature sets using the CLI" and "Checking OVN-Kubernetes network traffic with OVS sampling using the CLI".

https://github.com/openshift/openshift-docs/blob/main/contributing_to_docs/doc_guidelines.adoc#lead-in-link-sentence-style-for-non-xref-situations


.Prerequisites
* Must have `OVNObservability` enabled by enabling the `TechPreviewNoUpgrade` feature set in the `FeatureGate` CR named `cluster`. For more information, see "Enabling feature sets using the CLI" and "Checking OVN-Kubernetes network traffic with OVS sampling using the CLI" in the "Additional resources" of this section.
* You have created at least one of the following network APIs: `NetworkPolicy`, `AdminNetworkPolicy`, `BaselineNetworkPolicy`, `UserDefinedNetwork` isolation, multicast, or `EgressFirewall`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* You have created at least one of the following network APIs: `NetworkPolicy`, `AdminNetworkPolicy`, `BaselineNetworkPolicy`, `UserDefinedNetwork` isolation, multicast, or `EgressFirewall`.
* You have created at least one of the following network APIs:
** `NetworkPolicy`
** `AdminNetworkPolicy`
** `BaselineNetworkPolicy`
** `UserDefinedNetwork` isolation
** multicast
** `EgressFirewall`
  • Consider using a bullet list for better readability.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see your point, but I think I'll leave these since I bulleted them in the introduction.

. In the web console, navigate to *Operators* -> *Installed Operators*.
. In the *Provided APIs* heading for the *NetObserv Operator*, select *Flow Collector*.
. Select *cluster*, and then select the *YAML* tab.
. Configure the `FlowCollector` custom resource to enable viewing `NetworkEvents`, for example:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
. Configure the `FlowCollector` custom resource to enable viewing `NetworkEvents`, for example:
. Configure the `FlowCollector` CR to enable viewing `NetworkEvents`, for example:

features:
- "NetworkEvents"
----
<1> Optional: The `sampling` parameter is set to a value of 1 so that all network events are captured. If sampling 1 is too resource heavy, set sampling to something more appropriate for your needs.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<1> Optional: The `sampling` parameter is set to a value of 1 so that all network events are captured. If sampling 1 is too resource heavy, set sampling to something more appropriate for your needs.
<1> Optional: The `sampling` parameter is set to a value of `1` so that all network events are captured. If sampling `1` is too resource heavy, set sampling to something more appropriate for your needs.

Should 1 be in back ticks since it's a parameter's value?

- "NetworkEvents"
----
<1> Optional: The `sampling` parameter is set to a value of 1 so that all network events are captured. If sampling 1 is too resource heavy, set sampling to something more appropriate for your needs.
<2> The `privileged` parameter is set to `true` because the `OVN observability` library needs to access local OVS socket and OVN databases.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instances of OVS/OVN are the first ones, they need expanding --
Open vSwitch (OVS)
OpenShift Virtual Network (OVN)


.Verification
. Navigate to the *Network Traffic* view and select the *Traffic flows* table.
. You should see the new column, *Network Events*, where you can view information about impacts of one of the following network APIs you have enabled: `NetworkPolicy`, `AdminNetworkPolicy`, `BaselineNetworkPolicy`, `UserDefinedNetwork` isolation, multicast, or egress firewalls. An example of the kind of events you could see in this column is as follows:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
. You should see the new column, *Network Events*, where you can view information about impacts of one of the following network APIs you have enabled: `NetworkPolicy`, `AdminNetworkPolicy`, `BaselineNetworkPolicy`, `UserDefinedNetwork` isolation, multicast, or egress firewalls. An example of the kind of events you could see in this column is as follows:
. You should see the new column, *Network Events*, where you can view information about impacts of one of the following network APIs you have enabled:
* `NetworkPolicy`
* `AdminNetworkPolicy`
* `BaselineNetworkPolicy`
* `UserDefinedNetwork` isolation
* multicast
* egress firewalls
An example of the kind of events you could see in this column is as follows:

@xenolinux xenolinux added peer-review-done Signifies that the peer review team has reviewed this PR and removed peer-review-in-progress Signifies that the peer review team is reviewing this PR labels Feb 4, 2025
Copy link

openshift-ci bot commented Feb 10, 2025

@skrthomas: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@skrthomas
Copy link
Contributor Author

skrthomas commented Feb 11, 2025

Copying this PR to another, as it needs to go to 4.17, 4.18 only and the no-1.8 branch its currently against will go to 4.12+.

New PR to be merged: #88408

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
branch/enterprise-4.17 branch/enterprise-4.18 jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. peer-review-done Signifies that the peer review team has reviewed this PR size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants